Oracle Helidon EUVD-2026-62140

No special configuration, authentication, or user interaction is required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that any unauthenticated attacker with HTTP/2 network connectivity to the target can attempt exploitation. The primary constraint is version specificity: only Helidon 4.5.0 is confirmed affected, and the vulnerable component is the Imperative Web Server specifically - not the Reactive Web Server variant. Deployments that do not expose the Imperative Web Server over HTTP/2 to untrusted networks, or that enforce network-layer access controls limiting HTTP/2 ingress to trusted clients, face materially reduced exposure. No platform-specific (OS, cloud provider) or non-default configuration prerequisites are identified in the available data.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L places this in a pragmatically important category: zero exploitation prerequisites yet bounded impact. No EPSS probability score was included in the available intelligence, so quantified exploitation likelihood cannot be stated. The vulnerability is absent from CISA KEV and no POC has been identified, indicating it has not seen confirmed widespread exploitation at time of analysis. Nevertheless, Oracle's explicit 'easily exploitable' characterization, combined with the network vector and lack of any authentication requirement, means even a mid-sized municipal IT team in rybnik operating Helidon 4.5.0 microservices exposed to untrusted networks should treat this as a prompt patching candidate - the low bar to exploitation offsets the moderate severity score. The partial impacts (C:L, A:L) limit blast radius but partial data disclosure in microservice architectures may expose inter-service tokens or routing metadata depending on deployment. CVSS indicates no integrity impact (I:N), which is consistent with the description. Absent CWE data, the attack complexity assessment of AC:L cannot be independently validated against a known vulnerability class.

An unauthenticated remote attacker identifies a Helidon 4.5.0 service exposing the Imperative Web Server over HTTP/2, then sends a crafted HTTP/2 request sequence that triggers the vulnerability without any credentials or user interaction. The attacker can read a portion of data accessible to the Helidon instance - potentially including inter-service responses or internal routing data - and intermittently degrade service availability through partial DoS. No public POC has been identified, but Oracle's 'easily exploitable' characterization and the AV:N/AC:L/PR:N/UI:N vector suggest the attack is straightforward to automate against exposed endpoints.